CIRCL/vulnerability-attack-techniques huggingface dataset:
CVE-2022-22960: 
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. A malicious actor with local access can escalate privileges to 'root'.

Affected products: VMware Workspace ONE Access, Identity Manager and vRealize Automation
CWE: Privilege escalation, CWE-732 Incorrect Permission Assignment for Critical Resource
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1222
ATT&CK techniques (all): T1222
CVE-2024-4885: WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution Vulnerability
In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold.  The 

WhatsUp.ExportUtilities.Export.GetFileWithoutZip



 allows execution of commands with iisapppool\nmconsole privileges.

Affected products: Progress Software Corporation WhatsUp Gold, progress whatsup_gold
CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1068
ATT&CK primary impact: T1059
ATT&CK techniques (all): T1059, T1068
CVE-2010-5290: 
The authentication process in Adobe ColdFusion before 10 does not require knowledge of the cleartext password if the password hash is known, which makes it easier for context-dependent attackers to obtain administrative privileges by leveraging read access to the configuration file, a different vulnerability than CVE-2010-2861.

ATT&CK techniques (all): T1550.002, T1552.001
CVE-2019-0609: 
A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0639, CVE-2019-0680, CVE-2019-0769, CVE-2019-0770, CVE-2019-0771, CVE-2019-0773, CVE-2019-0783.

Affected products: Microsoft Internet Explorer 11, Microsoft Microsoft Edge, Microsoft ChakraCore
CWE: Remote Code Execution
ATT&CK exploitation technique(s): T1204.002, T1566
ATT&CK primary impact: T1499.004, T1574
ATT&CK secondary impact: T1005, T1136, T1485, T1565
ATT&CK techniques (all): T1005, T1136, T1204.002, T1485, T1499.004, T1565, T1566, T1574
CVE-2020-14510: OFF-BY-ONE ERROR CWE-193
GateManager versions prior to 9.2c, The affected product contains a hard-coded credential for telnet, allowing an unprivileged attacker to execute commands as root.

Affected products: Secomea GateManager
CWE: CWE-193 OFF-BY-ONE ERROR CWE-193
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK primary impact: T1078.001
ATT&CK secondary impact: T1059, T1068
ATT&CK techniques (all): T1059, T1068, T1078.001
CVE-2023-21715: Microsoft Publisher Security Feature Bypass Vulnerability
Microsoft Publisher Security Feature Bypass Vulnerability

Affected products: Microsoft Microsoft 365 Apps for Enterprise
CWE: Security Feature Bypass, CWE-863 Incorrect Authorization
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATT&CK exploitation technique(s): T1204.002
ATT&CK techniques (all): T1204.002
CVE-2025-27363: 
An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.

Affected products: FreeType FreeType
CWE: Out-of-bounds Write (CWE-787), CWE-787 Out-of-bounds Write
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/MS:U/MC:H/MI:H/MA:H
ATT&CK exploitation technique(s): T1204.002
ATT&CK primary impact: T1574
ATT&CK secondary impact: T1499.004
ATT&CK techniques (all): T1204.002, T1499.004, T1574
CVE-2016-9079: 
A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.

Affected products: Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird
CWE: Use-after-free in SVG Animation, CWE-416 Use After Free
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
ATT&CK techniques (all): T1189, T1203
CVE-2018-19010: 
Drager Infinity Delta, Infinity Delta, all versions, Delta XL, all versions, Kappa, all version, and Infinity Explorer C700, all versions. A malformed network packet may cause the monitor to reboot. By repeatedly sending the malformed network packet, an attacker may be able to disrupt patient monitoring by causing the monitor to repeatedly reboot until it falls back to default configuration and loses network connectivity.

Affected products: ICS-CERT Dr&#195;&#164;ger Infinity Delta
CWE: CWE-20 IMPROPER INPUT VALIDATION CWE-20
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1499
ATT&CK techniques (all): T1190, T1499
CVE-2024-20439: 
A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static administrative credential.
 This vulnerability is due to an undocumented static user credential for an administrative account. An attacker could exploit this vulnerability by using the static credentials to login to the affected system. A successful exploit could allow the attacker to login to the affected system with administrative rights over the CSLU application API.

Affected products: Cisco Cisco Smart License Utility, cisco cisco_smart_license_utility
CWE: CWE-912 Hidden Functionality
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1552
ATT&CK primary impact: T1106
ATT&CK techniques (all): T1106, T1552
CVE-2020-5362: 
Dell Client Consumer and Commercial platforms include an improper authorization vulnerability in the Dell Manageability interface for which an unauthorized actor, with local system access with OS administrator privileges, could bypass the BIOS Administrator authentication to restore BIOS Setup configuration to default values.

Affected products: Dell Dell Client Consumer and Commercial platforms
CWE: CWE-285: Improper Authorization
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:H
ATT&CK primary impact: T1068
ATT&CK secondary impact: T1098
ATT&CK techniques (all): T1068, T1098
CVE-2020-29557: 
An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20. A buffer overflow in the web interface allows attackers to achieve pre-authentication remote code execution.

CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1059
ATT&CK secondary impact: T1584.005
ATT&CK techniques (all): T1059, T1190, T1584.005
CVE-2019-1768: Cisco NX-OS Software Buffer Overflow and Command Injection Vulnerability
A vulnerability in the implementation of a specific CLI command for Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to cause a buffer overflow condition or perform command injection. This could allow the attacker to execute arbitrary commands with elevated privileges on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to a certain CLI command. An attacker could exploit this vulnerability by including malicious input as the argument of the affected CLI command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges. An attacker would need valid administrator credentials to exploit these vulnerabilities.

Affected products: Cisco Cisco NX-OS Software
CWE: CWE-119
CVSS: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1078
ATT&CK primary impact: T1608
ATT&CK secondary impact: T1059
ATT&CK techniques (all): T1059, T1078, T1608
CVE-2019-18573: 
The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a Session Fixation vulnerability. An authenticated malicious local user could potentially exploit this vulnerability as the session token is exposed as part of the URL. A remote attacker can gain access to victim’s session and perform arbitrary actions with privileges of the user within the compromised session.

Affected products: Dell RSA Identity Governance & Lifecycle
CWE: CWE-598: Information Exposure Through Query Strings in GET Request
CVSS: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
ATT&CK primary impact: T1563
ATT&CK techniques (all): T1563
CVE-2019-0211: 
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.

Affected products: Apache Apache HTTP Server
CWE: Apache HTTP Server privilege escalation from modules' scripts, CWE-416 Use After Free
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1068
ATT&CK techniques (all): T1068
CVE-2021-22894: 
A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to execute arbitrary code as the root user via maliciously crafted meeting room.

Affected products: Pulse Connect Secure
CWE: CWE-94 Code Injection (CWE-94)
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1078
ATT&CK primary impact: T1059
ATT&CK techniques (all): T1059, T1078
CVE-2021-33739: Microsoft DWM Core Library Elevation of Privilege Vulnerability
Microsoft DWM Core Library Elevation of Privilege Vulnerability

Affected products: Microsoft Windows 10 Version 1909, Microsoft Windows 10 Version 21H1, Microsoft Windows 10 Version 2004, Microsoft Windows Server version 2004, Microsoft Windows 10 Version 20H2, Microsoft Windows Server version 20H2
CWE: Elevation of Privilege, CWE-noinfo Not enough information
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
ATT&CK exploitation technique(s): T1598.002
ATT&CK primary impact: T1068
ATT&CK techniques (all): T1068, T1598.002
CVE-2020-1456: 
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1450, CVE-2020-1451.

Affected products: Microsoft Microsoft SharePoint Enterprise Server, Microsoft Microsoft SharePoint Server
CWE: Spoofing, CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
ATT&CK primary impact: T1059
ATT&CK secondary impact: T1005, T1036, T1485, T1565
ATT&CK techniques (all): T1005, T1036, T1059, T1485, T1565
CVE-2019-7286: 
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4, macOS Mojave 10.14.3 Supplemental Update. An application may be able to gain elevated privileges.

Affected products: Apple iOS, Apple macOS
CWE: An application may be able to gain elevated privileges, CWE-787 Out-of-bounds Write
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
ATT&CK techniques (all): T1189, T1203
CVE-2020-5297: Upload whitelisted files to any directory in OctoberCMS
In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to upload jpg, jpeg, bmp, png, webp, gif, ico, css, js, woff, woff2, svg, ttf, eot, json, md, less, sass, scss, xml files to any directory of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466).

Affected products: octobercms october
CWE: CWE-73: External Control of File Name or Path
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N
ATT&CK primary impact: T1505.003
ATT&CK secondary impact: T1059
ATT&CK techniques (all): T1059, T1505.003
CVE-2019-13511: 
Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain an INFORMATION EXPOSURE CWE-200. A maliciously crafted Arena file opened by an unsuspecting user may result in the limited exposure of information related to the targeted workstation.

Affected products: Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier
CWE: CWE-200 INFORMATION EXPOSURE CWE-200 (CVE-2019-13511)
ATT&CK exploitation technique(s): T1204.001
ATT&CK primary impact: T1005
ATT&CK techniques (all): T1005, T1204.001
CVE-2016-10033: 
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.

CWE: CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1059.004
ATT&CK techniques (all): T1059.004, T1190
CVE-2017-11368: 
In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests.

ATT&CK techniques (all): T1078, T1212
CVE-2023-48365: 
Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. The fixed versions are August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17. NOTE: this issue exists because of an incomplete fix for CVE-2023-41265.

CWE: CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CVSS: CVSS:3.1/AC:L/AV:N/A:N/C:H/I:H/PR:L/S:C/UI:N
ATT&CK exploitation technique(s): T1133, T1190
ATT&CK primary impact: T1059
ATT&CK techniques (all): T1059, T1133, T1190
CVE-2025-22224: 
VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.

Affected products: VMware ESXi, VMware Workstation, VMware VMware Cloud Foundation, VMware Telco Cloud Platform, VMware Telco Cloud Infrastructure
CWE: Heap-overflow vulnerability, CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1055
ATT&CK primary impact: T1611
ATT&CK techniques (all): T1055, T1611
CVE-2020-5376: 
Dell Inspiron 7347 BIOS versions prior to A13 contain a UEFI BIOS Boot Services overwrite vulnerability. A local attacker with access to system memory may exploit this vulnerability by overwriting the EFI_BOOT_SERVICES structure to execute arbitrary code in System Management Mode (SMM).

Affected products: Dell CPG BIOS
CWE: CWE-416: Use After Free
CVSS: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK primary impact: T1542.001
ATT&CK techniques (all): T1542.001
CVE-2020-5331: 
RSA Archer, versions prior to 6.7 P3 (6.7.0.3), contain an information exposure vulnerability. Users’ session information could potentially be stored in cache or log files. An authenticated malicious local user with access to the log files may obtain the exposed information to use it in further attacks.

Affected products: Dell RSA Archer
CWE: CWE-598: Information Exposure Through Query Strings in GET Request
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
ATT&CK primary impact: T1005
ATT&CK techniques (all): T1005
CVE-2017-15211: 
In Kanboard before 1.0.47, by altering form data, an authenticated user can add an external link to a private project of another user.

ATT&CK techniques (all): T1068, T1566
CVE-2019-1612: Cisco NX-OS Software CLI Command Injection Vulnerability (CVE-2019-1612)
A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability. Nexus 3000 Series Switches are affected running software versions prior to 7.0(3)I4(9) and 7.0(3)I7(4). Nexus 3500 Platform Switches are affected running software versions prior to 7.0(3)I7(4). Nexus 3600 Platform Switches are affected running software versions prior to 7.0(3)F3(5). Nexus 9000 Series Switches in Stand are affected running software versions prior to 7.0(3)F3(5).

Affected products: Cisco Nexus 3000 Series Switches, Cisco Nexus 3500 Platform Switches, Cisco Nexus 3600 Platform Switches, Cisco Nexus 9000 Series Switches in Standalone NX-OS Mode, Cisco Nexus 9500 R-Series Line Cards and Fabric Modules
CWE: CWE-77
CVSS: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
ATT&CK exploitation technique(s): T1078, T1133
ATT&CK primary impact: T1059
ATT&CK secondary impact: T1068
ATT&CK techniques (all): T1059, T1068, T1078, T1133
CVE-2014-7235: 
htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface (ARI) in FreePBX before 2.9.0.9, 2.10.x, and 2.11 before 2.11.1.5 allows remote attackers to execute arbitrary code via the ari_auth cookie, related to the PHP unserialize function, as exploited in the wild in September 2014.

ATT&CK techniques (all): T1190, T1550
CVE-2019-15243: Cisco SPA100 Series Analog Telephone Adapters Remote Code Execution Vulnerabilities
Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit these vulnerabilities by authenticating to the web-based management interface and sending crafted requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code with elevated privileges. Note: The web-based management interface is enabled by default.

Affected products: Cisco Cisco SPA112 2-Port Phone Adapter
CWE: CWE-119
CVSS: CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1078, T1190
ATT&CK primary impact: T1059
ATT&CK techniques (all): T1059, T1078, T1190
CVE-2020-3349: Cisco Data Center Network Manager Cross-Site Scripting Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface on an affected device. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a customized link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information.

Affected products: Cisco Cisco Data Center Network Manager
CWE: CWE-79
CVSS: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
ATT&CK exploitation technique(s): T1204.001
ATT&CK primary impact: T1059.007
ATT&CK secondary impact: T1557
ATT&CK techniques (all): T1059.007, T1204.001, T1557
CVE-2022-22965: 
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

Affected products: Spring Framework
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1059
ATT&CK techniques (all): T1059, T1190
CVE-2018-15761: UAA Privilege Escalation
Cloud Foundry UAA release, versions prior to v64.0, and UAA, versions prior to 4.23.0, contains a validation error which allows for privilege escalation. A remote authenticated user may modify the url and content of a consent page to gain a token with arbitrary scopes that escalates their privileges.

Affected products: Cloud Foundry UAA, Cloud Foundry UAA Release
CWE: Improper Access Control
CVSS: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1078
ATT&CK primary impact: T1068
ATT&CK techniques (all): T1068, T1078
CVE-2016-0034: 
Microsoft Silverlight 5 before 5.1.41212.0 mishandles negative offsets during decoding, which allows remote attackers to execute arbitrary code or cause a denial of service (object-header corruption) via a crafted web site, aka "Silverlight Runtime Remote Code Execution Vulnerability."

CWE: CWE-noinfo Not enough information
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
ATT&CK techniques (all): T1189, T1203, T1499.004
CVE-2018-14809: 
Fuji Electric V-Server 4.0.3.0 and prior, A use after free vulnerability has been identified, which may allow remote code execution.

Affected products: Fuji Electric V-Server
CWE: CWE-416 USE AFTER FREE CWE-416
ATT&CK primary impact: T1005, T1499.004, T1557, T1574
ATT&CK techniques (all): T1005, T1499.004, T1557, T1574
CVE-2020-1206: 
An information disclosure vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Information Disclosure Vulnerability'.

Affected products: Microsoft Windows 10 Version 1909 for 32-bit Systems, Microsoft Windows 10 Version 1909 for x64-based Systems, Microsoft Windows 10 Version 1909 for ARM64-based Systems, Microsoft Windows Server, version 1909 (Server Core installation), Microsoft Windows 10 Version 1903 for 32-bit Systems, Microsoft Windows 10 Version 1903 for x64-based Systems, Microsoft Windows 10 Version 1903 for ARM64-based Systems, Microsoft Windows Server, version 1903 (Server Core installation), Microsoft Windows 10 Version 2004 for ARM64-based Systems, Microsoft Windows 10 Version 2004 for x64-based Systems, Microsoft Windows 10 Version 2004 for 32-bit Systems, Microsoft Windows Server, version 2004 (Server Core installation)
CWE: Information Disclosure
ATT&CK techniques (all): T1210